@dotsetlabs/tollgate 0.2.2 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (194) hide show
  1. package/README.md +138 -0
  2. package/dist/analyzers/filesystem.d.ts +5 -0
  3. package/dist/analyzers/filesystem.d.ts.map +1 -1
  4. package/dist/analyzers/filesystem.js +61 -7
  5. package/dist/analyzers/filesystem.js.map +1 -1
  6. package/dist/analyzers/loader.d.ts +5 -0
  7. package/dist/analyzers/loader.d.ts.map +1 -1
  8. package/dist/analyzers/loader.js +112 -6
  9. package/dist/analyzers/loader.js.map +1 -1
  10. package/dist/analyzers/prompt-injection.d.ts +1 -0
  11. package/dist/analyzers/prompt-injection.d.ts.map +1 -1
  12. package/dist/analyzers/prompt-injection.js +48 -2
  13. package/dist/analyzers/prompt-injection.js.map +1 -1
  14. package/dist/analyzers/shell.d.ts +8 -0
  15. package/dist/analyzers/shell.d.ts.map +1 -1
  16. package/dist/analyzers/shell.js +109 -8
  17. package/dist/analyzers/shell.js.map +1 -1
  18. package/dist/analyzers/sql.d.ts.map +1 -1
  19. package/dist/analyzers/sql.js +8 -7
  20. package/dist/analyzers/sql.js.map +1 -1
  21. package/dist/approval/interactive.d.ts +1 -1
  22. package/dist/approval/interactive.d.ts.map +1 -1
  23. package/dist/approval/interactive.js +13 -1
  24. package/dist/approval/interactive.js.map +1 -1
  25. package/dist/approval/rate-limiter.d.ts +115 -0
  26. package/dist/approval/rate-limiter.d.ts.map +1 -0
  27. package/dist/approval/rate-limiter.js +200 -0
  28. package/dist/approval/rate-limiter.js.map +1 -0
  29. package/dist/approval/url-validator.d.ts +51 -0
  30. package/dist/approval/url-validator.d.ts.map +1 -0
  31. package/dist/approval/url-validator.js +184 -0
  32. package/dist/approval/url-validator.js.map +1 -0
  33. package/dist/approval/webhook.d.ts +48 -0
  34. package/dist/approval/webhook.d.ts.map +1 -1
  35. package/dist/approval/webhook.js +89 -0
  36. package/dist/approval/webhook.js.map +1 -1
  37. package/dist/audit/integrity.d.ts +107 -0
  38. package/dist/audit/integrity.d.ts.map +1 -0
  39. package/dist/audit/integrity.js +191 -0
  40. package/dist/audit/integrity.js.map +1 -0
  41. package/dist/audit/logger.d.ts.map +1 -1
  42. package/dist/audit/logger.js +6 -5
  43. package/dist/audit/logger.js.map +1 -1
  44. package/dist/audit/redaction.js +6 -4
  45. package/dist/audit/redaction.js.map +1 -1
  46. package/dist/cli/commands/guard.d.ts +97 -0
  47. package/dist/cli/commands/guard.d.ts.map +1 -0
  48. package/dist/cli/commands/guard.js +456 -0
  49. package/dist/cli/commands/guard.js.map +1 -0
  50. package/dist/cli/commands/serve.js +1 -1
  51. package/dist/cli/commands/serve.js.map +1 -1
  52. package/dist/cli/index.js +3 -0
  53. package/dist/cli/index.js.map +1 -1
  54. package/dist/cli/input-validation.d.ts +83 -0
  55. package/dist/cli/input-validation.d.ts.map +1 -0
  56. package/dist/cli/input-validation.js +237 -0
  57. package/dist/cli/input-validation.js.map +1 -0
  58. package/dist/cli/ui.js +2 -2
  59. package/dist/cli/ui.js.map +1 -1
  60. package/dist/guard/alternatives/index.d.ts +68 -0
  61. package/dist/guard/alternatives/index.d.ts.map +1 -0
  62. package/dist/guard/alternatives/index.js +224 -0
  63. package/dist/guard/alternatives/index.js.map +1 -0
  64. package/dist/guard/alternatives/registry.d.ts +16 -0
  65. package/dist/guard/alternatives/registry.d.ts.map +1 -0
  66. package/dist/guard/alternatives/registry.js +518 -0
  67. package/dist/guard/alternatives/registry.js.map +1 -0
  68. package/dist/guard/alternatives/types.d.ts +86 -0
  69. package/dist/guard/alternatives/types.d.ts.map +1 -0
  70. package/dist/guard/alternatives/types.js +5 -0
  71. package/dist/guard/alternatives/types.js.map +1 -0
  72. package/dist/guard/approval/enhanced-terminal.d.ts +110 -0
  73. package/dist/guard/approval/enhanced-terminal.d.ts.map +1 -0
  74. package/dist/guard/approval/enhanced-terminal.js +387 -0
  75. package/dist/guard/approval/enhanced-terminal.js.map +1 -0
  76. package/dist/guard/config.d.ts +80 -0
  77. package/dist/guard/config.d.ts.map +1 -0
  78. package/dist/guard/config.js +260 -0
  79. package/dist/guard/config.js.map +1 -0
  80. package/dist/guard/context/directory.d.ts +35 -0
  81. package/dist/guard/context/directory.d.ts.map +1 -0
  82. package/dist/guard/context/directory.js +243 -0
  83. package/dist/guard/context/directory.js.map +1 -0
  84. package/dist/guard/context/environment.d.ts +31 -0
  85. package/dist/guard/context/environment.d.ts.map +1 -0
  86. package/dist/guard/context/environment.js +204 -0
  87. package/dist/guard/context/environment.js.map +1 -0
  88. package/dist/guard/context/git.d.ts +52 -0
  89. package/dist/guard/context/git.d.ts.map +1 -0
  90. package/dist/guard/context/git.js +278 -0
  91. package/dist/guard/context/git.js.map +1 -0
  92. package/dist/guard/context/index.d.ts +64 -0
  93. package/dist/guard/context/index.d.ts.map +1 -0
  94. package/dist/guard/context/index.js +227 -0
  95. package/dist/guard/context/index.js.map +1 -0
  96. package/dist/guard/context/project.d.ts +47 -0
  97. package/dist/guard/context/project.d.ts.map +1 -0
  98. package/dist/guard/context/project.js +281 -0
  99. package/dist/guard/context/project.js.map +1 -0
  100. package/dist/guard/context/types.d.ts +152 -0
  101. package/dist/guard/context/types.d.ts.map +1 -0
  102. package/dist/guard/context/types.js +7 -0
  103. package/dist/guard/context/types.js.map +1 -0
  104. package/dist/guard/engine.d.ts +107 -0
  105. package/dist/guard/engine.d.ts.map +1 -0
  106. package/dist/guard/engine.js +430 -0
  107. package/dist/guard/engine.js.map +1 -0
  108. package/dist/guard/enhanced-engine.d.ts +151 -0
  109. package/dist/guard/enhanced-engine.d.ts.map +1 -0
  110. package/dist/guard/enhanced-engine.js +622 -0
  111. package/dist/guard/enhanced-engine.js.map +1 -0
  112. package/dist/guard/hooks/index.d.ts +50 -0
  113. package/dist/guard/hooks/index.d.ts.map +1 -0
  114. package/dist/guard/hooks/index.js +325 -0
  115. package/dist/guard/hooks/index.js.map +1 -0
  116. package/dist/guard/index.d.ts +29 -0
  117. package/dist/guard/index.d.ts.map +1 -0
  118. package/dist/guard/index.js +31 -0
  119. package/dist/guard/index.js.map +1 -0
  120. package/dist/guard/learning/index.d.ts +136 -0
  121. package/dist/guard/learning/index.d.ts.map +1 -0
  122. package/dist/guard/learning/index.js +314 -0
  123. package/dist/guard/learning/index.js.map +1 -0
  124. package/dist/guard/learning/pattern-extractor.d.ts +50 -0
  125. package/dist/guard/learning/pattern-extractor.d.ts.map +1 -0
  126. package/dist/guard/learning/pattern-extractor.js +372 -0
  127. package/dist/guard/learning/pattern-extractor.js.map +1 -0
  128. package/dist/guard/learning/rule-suggester.d.ts +67 -0
  129. package/dist/guard/learning/rule-suggester.d.ts.map +1 -0
  130. package/dist/guard/learning/rule-suggester.js +345 -0
  131. package/dist/guard/learning/rule-suggester.js.map +1 -0
  132. package/dist/guard/learning/types.d.ts +211 -0
  133. package/dist/guard/learning/types.d.ts.map +1 -0
  134. package/dist/guard/learning/types.js +18 -0
  135. package/dist/guard/learning/types.js.map +1 -0
  136. package/dist/guard/preview/effects.d.ts +15 -0
  137. package/dist/guard/preview/effects.d.ts.map +1 -0
  138. package/dist/guard/preview/effects.js +413 -0
  139. package/dist/guard/preview/effects.js.map +1 -0
  140. package/dist/guard/preview/index.d.ts +49 -0
  141. package/dist/guard/preview/index.d.ts.map +1 -0
  142. package/dist/guard/preview/index.js +196 -0
  143. package/dist/guard/preview/index.js.map +1 -0
  144. package/dist/guard/preview/parser.d.ts +34 -0
  145. package/dist/guard/preview/parser.d.ts.map +1 -0
  146. package/dist/guard/preview/parser.js +292 -0
  147. package/dist/guard/preview/parser.js.map +1 -0
  148. package/dist/guard/preview/types.d.ts +140 -0
  149. package/dist/guard/preview/types.d.ts.map +1 -0
  150. package/dist/guard/preview/types.js +5 -0
  151. package/dist/guard/preview/types.js.map +1 -0
  152. package/dist/guard/reversibility/index.d.ts +88 -0
  153. package/dist/guard/reversibility/index.d.ts.map +1 -0
  154. package/dist/guard/reversibility/index.js +310 -0
  155. package/dist/guard/reversibility/index.js.map +1 -0
  156. package/dist/guard/types.d.ts +192 -0
  157. package/dist/guard/types.d.ts.map +1 -0
  158. package/dist/guard/types.js +8 -0
  159. package/dist/guard/types.js.map +1 -0
  160. package/dist/index.d.ts +10 -0
  161. package/dist/index.d.ts.map +1 -1
  162. package/dist/index.js +24 -0
  163. package/dist/index.js.map +1 -1
  164. package/dist/orchestrator/manager.d.ts.map +1 -1
  165. package/dist/orchestrator/manager.js +6 -1
  166. package/dist/orchestrator/manager.js.map +1 -1
  167. package/dist/policy/engine.d.ts.map +1 -1
  168. package/dist/policy/engine.js +11 -3
  169. package/dist/policy/engine.js.map +1 -1
  170. package/dist/policy/parser.d.ts.map +1 -1
  171. package/dist/policy/parser.js +3 -0
  172. package/dist/policy/parser.js.map +1 -1
  173. package/dist/proxy/server.d.ts.map +1 -1
  174. package/dist/proxy/server.js +8 -6
  175. package/dist/proxy/server.js.map +1 -1
  176. package/dist/session/manager.d.ts +2 -2
  177. package/dist/session/manager.d.ts.map +1 -1
  178. package/dist/session/manager.js +106 -88
  179. package/dist/session/manager.js.map +1 -1
  180. package/dist/session/signing.d.ts +88 -0
  181. package/dist/session/signing.d.ts.map +1 -0
  182. package/dist/session/signing.js +166 -0
  183. package/dist/session/signing.js.map +1 -0
  184. package/dist/session/types.d.ts +2 -0
  185. package/dist/session/types.d.ts.map +1 -1
  186. package/dist/session/types.js.map +1 -1
  187. package/dist/utils/security-logger.d.ts +146 -0
  188. package/dist/utils/security-logger.d.ts.map +1 -0
  189. package/dist/utils/security-logger.js +222 -0
  190. package/dist/utils/security-logger.js.map +1 -0
  191. package/dist/wizard.d.ts.map +1 -1
  192. package/dist/wizard.js +7 -1
  193. package/dist/wizard.js.map +1 -1
  194. package/package.json +3 -2
@@ -0,0 +1,50 @@
1
+ /**
2
+ * Shell Hook Generator for Tollgate Guard
3
+ *
4
+ * Generates shell-specific hook scripts that intercept commands
5
+ * before execution and route them through Tollgate Guard.
6
+ */
7
+ /**
8
+ * Bash hook script using bash-preexec pattern.
9
+ *
10
+ * This script:
11
+ * 1. Defines a preexec function that intercepts commands
12
+ * 2. Calls `tollgate guard check` for non-trivial commands
13
+ * 3. Blocks execution if check fails (exit code != 0)
14
+ * 4. Provides helper functions for enable/disable/status
15
+ */
16
+ export declare const BASH_HOOK = "# Tollgate Guard - Bash Hook\n# Usage: eval \"$(tollgate guard hook bash)\"\n# Or add to ~/.bashrc: eval \"$(tollgate guard hook bash)\"\n\n# Skip if already installed\n[[ -n \"$__TOLLGATE_GUARD_INSTALLED\" ]] && return 0\n\n__tollgate_guard_preexec() {\n # Skip if disabled\n [[ -n \"$TOLLGATE_GUARD_DISABLED\" ]] && return 0\n\n # Skip empty commands\n [[ -z \"$1\" ]] && return 0\n\n # Skip if already in guard process (prevent recursion)\n [[ -n \"$__TOLLGATE_GUARD_RUNNING\" ]] && return 0\n\n local cmd=\"$1\"\n\n # Fast path: skip common safe commands for performance\n case \"${cmd%% *}\" in\n ls|cd|pwd|echo|cat|less|more|head|tail|grep|find|which|type|man|help|history|alias)\n return 0\n ;;\n # Git read-only commands\n \"git status\"|\"git diff\"|\"git log\"|\"git branch\"|\"git show\")\n return 0\n ;;\n esac\n\n export __TOLLGATE_GUARD_RUNNING=1\n\n # Call tollgate guard check\n # Use /dev/tty for I/O to work even when stdout is redirected\n if ! tollgate guard check \"$cmd\" </dev/tty 2>/dev/tty; then\n unset __TOLLGATE_GUARD_RUNNING\n # Kill the current command by sending SIGINT\n kill -INT $$\n return 1\n fi\n\n unset __TOLLGATE_GUARD_RUNNING\n return 0\n}\n\n# Install hook using bash-preexec if available\nif declare -F preexec_functions &>/dev/null 2>&1; then\n preexec_functions+=(__tollgate_guard_preexec)\nelse\n # Fallback: use DEBUG trap\n # Note: This runs for every simple command, which can be noisy\n # for scripts. bash-preexec is preferred.\n __tollgate_original_debug_trap=$(trap -p DEBUG 2>/dev/null || true)\n trap '__tollgate_guard_preexec \"$BASH_COMMAND\"' DEBUG\nfi\n\n__TOLLGATE_GUARD_INSTALLED=1\n\n# Helper functions\ntollgate-guard-disable() {\n export TOLLGATE_GUARD_DISABLED=1\n echo \"Tollgate Guard disabled for this session\"\n}\n\ntollgate-guard-enable() {\n unset TOLLGATE_GUARD_DISABLED\n echo \"Tollgate Guard enabled\"\n}\n\ntollgate-guard-status() {\n if [[ -n \"$TOLLGATE_GUARD_DISABLED\" ]]; then\n echo \"Tollgate Guard: DISABLED\"\n else\n echo \"Tollgate Guard: ENABLED\"\n fi\n tollgate guard sessions 2>/dev/null || true\n}\n";
17
+ /**
18
+ * Zsh hook script using accept-line widget override.
19
+ *
20
+ * This is more reliable than preexec in Zsh because it intercepts
21
+ * at the input level, before the command is even parsed.
22
+ */
23
+ export declare const ZSH_HOOK = "# Tollgate Guard - Zsh Hook\n# Usage: eval \"$(tollgate guard hook zsh)\"\n# Or add to ~/.zshrc: eval \"$(tollgate guard hook zsh)\"\n\n# Skip if already installed\n[[ -n \"$__TOLLGATE_GUARD_INSTALLED\" ]] && return 0\n\n__tollgate_guard_accept_line() {\n # Skip if disabled\n [[ -n \"$TOLLGATE_GUARD_DISABLED\" ]] && { zle .accept-line; return }\n\n # Skip empty buffer\n [[ -z \"$BUFFER\" ]] && { zle .accept-line; return }\n\n # Skip if already checking (prevent recursion)\n [[ -n \"$__TOLLGATE_GUARD_RUNNING\" ]] && { zle .accept-line; return }\n\n local cmd=\"$BUFFER\"\n\n # Fast path: skip common safe commands\n case \"${cmd%% *}\" in\n ls|cd|pwd|echo|cat|less|more|head|tail|grep|find|which|type|man|help|history|alias)\n zle .accept-line\n return\n ;;\n esac\n\n # Fast path for git read-only\n case \"$cmd\" in\n \"git status\"*|\"git diff\"*|\"git log\"*|\"git branch\"*|\"git show\"*)\n zle .accept-line\n return\n ;;\n esac\n\n __TOLLGATE_GUARD_RUNNING=1\n\n # Call tollgate guard check\n # Use /dev/tty for I/O since we're in a widget\n if tollgate guard check \"$cmd\" </dev/tty 2>/dev/tty; then\n unset __TOLLGATE_GUARD_RUNNING\n zle .accept-line\n else\n unset __TOLLGATE_GUARD_RUNNING\n # Clear the buffer and show message\n BUFFER=\"\"\n zle redisplay\n echo \"\\nCommand cancelled by Tollgate Guard\" >/dev/tty\n fi\n}\n\n# Override accept-line widget\n# The dot prefix (.accept-line) calls the built-in version\nzle -N accept-line __tollgate_guard_accept_line\n\n__TOLLGATE_GUARD_INSTALLED=1\n\n# Helper functions\ntollgate-guard-disable() {\n export TOLLGATE_GUARD_DISABLED=1\n echo \"Tollgate Guard disabled for this session\"\n}\n\ntollgate-guard-enable() {\n unset TOLLGATE_GUARD_DISABLED\n echo \"Tollgate Guard enabled\"\n}\n\ntollgate-guard-status() {\n if [[ -n \"$TOLLGATE_GUARD_DISABLED\" ]]; then\n echo \"Tollgate Guard: DISABLED\"\n else\n echo \"Tollgate Guard: ENABLED\"\n fi\n tollgate guard sessions 2>/dev/null || true\n}\n";
24
+ /**
25
+ * Fish hook script using key binding.
26
+ *
27
+ * Fish doesn't support true preexec that can cancel commands,
28
+ * so we bind Enter to a custom function.
29
+ */
30
+ export declare const FISH_HOOK = "# Tollgate Guard - Fish Hook\n# Usage: tollgate guard hook fish | source\n# Or add to ~/.config/fish/config.fish: tollgate guard hook fish | source\n\n# Skip if already installed\nset -q __TOLLGATE_GUARD_INSTALLED; and exit 0\n\nfunction __tollgate_guard_check\n # Skip if disabled\n set -q TOLLGATE_GUARD_DISABLED; and return 0\n\n # Skip empty command\n set -l cmd (commandline -b)\n test -z \"$cmd\"; and return 0\n\n # Skip if already running\n set -q __TOLLGATE_GUARD_RUNNING; and return 0\n\n # Fast path for safe commands\n set -l first_word (string split ' ' -- $cmd)[1]\n switch $first_word\n case ls cd pwd echo cat less more head tail grep find which type man help history alias\n return 0\n end\n\n # Fast path for git read-only\n switch $cmd\n case \"git status*\" \"git diff*\" \"git log*\" \"git branch*\" \"git show*\"\n return 0\n end\n\n set -g __TOLLGATE_GUARD_RUNNING 1\n\n # Call tollgate guard check\n if tollgate guard check \"$cmd\" </dev/tty 2>/dev/tty\n set -e __TOLLGATE_GUARD_RUNNING\n return 0\n else\n set -e __TOLLGATE_GUARD_RUNNING\n commandline \"\"\n echo \"Command cancelled by Tollgate Guard\"\n return 1\n end\nend\n\nfunction __tollgate_guard_execute\n if __tollgate_guard_check\n commandline -f execute\n end\nend\n\n# Bind Enter key to our function\nbind \\r __tollgate_guard_execute\nbind \\n __tollgate_guard_execute\n\nset -g __TOLLGATE_GUARD_INSTALLED 1\n\n# Helper functions\nfunction tollgate-guard-disable\n set -gx TOLLGATE_GUARD_DISABLED 1\n echo \"Tollgate Guard disabled for this session\"\nend\n\nfunction tollgate-guard-enable\n set -e TOLLGATE_GUARD_DISABLED\n echo \"Tollgate Guard enabled\"\nend\n\nfunction tollgate-guard-status\n if set -q TOLLGATE_GUARD_DISABLED\n echo \"Tollgate Guard: DISABLED\"\n else\n echo \"Tollgate Guard: ENABLED\"\n end\n tollgate guard sessions 2>/dev/null; or true\nend\n";
31
+ /**
32
+ * Get the appropriate hook script for a shell.
33
+ *
34
+ * @param shell - Shell type (bash, zsh, fish)
35
+ * @returns Hook script content
36
+ */
37
+ export declare function getHookScript(shell: string): string;
38
+ /**
39
+ * Detect the current shell from environment.
40
+ */
41
+ export declare function detectShell(): string;
42
+ /**
43
+ * Get the shell configuration file path.
44
+ */
45
+ export declare function getShellConfigPath(shell: string): string;
46
+ /**
47
+ * Generate the line to add to shell config.
48
+ */
49
+ export declare function getConfigLine(shell: string): string;
50
+ //# sourceMappingURL=index.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/guard/hooks/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,yvEA6ErB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,ipEA4EpB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,SAAS,kgEA4ErB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWnD;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAepC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAaxD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUnD"}
@@ -0,0 +1,325 @@
1
+ /**
2
+ * Shell Hook Generator for Tollgate Guard
3
+ *
4
+ * Generates shell-specific hook scripts that intercept commands
5
+ * before execution and route them through Tollgate Guard.
6
+ */
7
+ /**
8
+ * Bash hook script using bash-preexec pattern.
9
+ *
10
+ * This script:
11
+ * 1. Defines a preexec function that intercepts commands
12
+ * 2. Calls `tollgate guard check` for non-trivial commands
13
+ * 3. Blocks execution if check fails (exit code != 0)
14
+ * 4. Provides helper functions for enable/disable/status
15
+ */
16
+ export const BASH_HOOK = `# Tollgate Guard - Bash Hook
17
+ # Usage: eval "$(tollgate guard hook bash)"
18
+ # Or add to ~/.bashrc: eval "$(tollgate guard hook bash)"
19
+
20
+ # Skip if already installed
21
+ [[ -n "$__TOLLGATE_GUARD_INSTALLED" ]] && return 0
22
+
23
+ __tollgate_guard_preexec() {
24
+ # Skip if disabled
25
+ [[ -n "$TOLLGATE_GUARD_DISABLED" ]] && return 0
26
+
27
+ # Skip empty commands
28
+ [[ -z "$1" ]] && return 0
29
+
30
+ # Skip if already in guard process (prevent recursion)
31
+ [[ -n "$__TOLLGATE_GUARD_RUNNING" ]] && return 0
32
+
33
+ local cmd="$1"
34
+
35
+ # Fast path: skip common safe commands for performance
36
+ case "\${cmd%% *}" in
37
+ ls|cd|pwd|echo|cat|less|more|head|tail|grep|find|which|type|man|help|history|alias)
38
+ return 0
39
+ ;;
40
+ # Git read-only commands
41
+ "git status"|"git diff"|"git log"|"git branch"|"git show")
42
+ return 0
43
+ ;;
44
+ esac
45
+
46
+ export __TOLLGATE_GUARD_RUNNING=1
47
+
48
+ # Call tollgate guard check
49
+ # Use /dev/tty for I/O to work even when stdout is redirected
50
+ if ! tollgate guard check "$cmd" </dev/tty 2>/dev/tty; then
51
+ unset __TOLLGATE_GUARD_RUNNING
52
+ # Kill the current command by sending SIGINT
53
+ kill -INT $$
54
+ return 1
55
+ fi
56
+
57
+ unset __TOLLGATE_GUARD_RUNNING
58
+ return 0
59
+ }
60
+
61
+ # Install hook using bash-preexec if available
62
+ if declare -F preexec_functions &>/dev/null 2>&1; then
63
+ preexec_functions+=(__tollgate_guard_preexec)
64
+ else
65
+ # Fallback: use DEBUG trap
66
+ # Note: This runs for every simple command, which can be noisy
67
+ # for scripts. bash-preexec is preferred.
68
+ __tollgate_original_debug_trap=$(trap -p DEBUG 2>/dev/null || true)
69
+ trap '__tollgate_guard_preexec "$BASH_COMMAND"' DEBUG
70
+ fi
71
+
72
+ __TOLLGATE_GUARD_INSTALLED=1
73
+
74
+ # Helper functions
75
+ tollgate-guard-disable() {
76
+ export TOLLGATE_GUARD_DISABLED=1
77
+ echo "Tollgate Guard disabled for this session"
78
+ }
79
+
80
+ tollgate-guard-enable() {
81
+ unset TOLLGATE_GUARD_DISABLED
82
+ echo "Tollgate Guard enabled"
83
+ }
84
+
85
+ tollgate-guard-status() {
86
+ if [[ -n "$TOLLGATE_GUARD_DISABLED" ]]; then
87
+ echo "Tollgate Guard: DISABLED"
88
+ else
89
+ echo "Tollgate Guard: ENABLED"
90
+ fi
91
+ tollgate guard sessions 2>/dev/null || true
92
+ }
93
+ `;
94
+ /**
95
+ * Zsh hook script using accept-line widget override.
96
+ *
97
+ * This is more reliable than preexec in Zsh because it intercepts
98
+ * at the input level, before the command is even parsed.
99
+ */
100
+ export const ZSH_HOOK = `# Tollgate Guard - Zsh Hook
101
+ # Usage: eval "$(tollgate guard hook zsh)"
102
+ # Or add to ~/.zshrc: eval "$(tollgate guard hook zsh)"
103
+
104
+ # Skip if already installed
105
+ [[ -n "$__TOLLGATE_GUARD_INSTALLED" ]] && return 0
106
+
107
+ __tollgate_guard_accept_line() {
108
+ # Skip if disabled
109
+ [[ -n "$TOLLGATE_GUARD_DISABLED" ]] && { zle .accept-line; return }
110
+
111
+ # Skip empty buffer
112
+ [[ -z "$BUFFER" ]] && { zle .accept-line; return }
113
+
114
+ # Skip if already checking (prevent recursion)
115
+ [[ -n "$__TOLLGATE_GUARD_RUNNING" ]] && { zle .accept-line; return }
116
+
117
+ local cmd="$BUFFER"
118
+
119
+ # Fast path: skip common safe commands
120
+ case "\${cmd%% *}" in
121
+ ls|cd|pwd|echo|cat|less|more|head|tail|grep|find|which|type|man|help|history|alias)
122
+ zle .accept-line
123
+ return
124
+ ;;
125
+ esac
126
+
127
+ # Fast path for git read-only
128
+ case "$cmd" in
129
+ "git status"*|"git diff"*|"git log"*|"git branch"*|"git show"*)
130
+ zle .accept-line
131
+ return
132
+ ;;
133
+ esac
134
+
135
+ __TOLLGATE_GUARD_RUNNING=1
136
+
137
+ # Call tollgate guard check
138
+ # Use /dev/tty for I/O since we're in a widget
139
+ if tollgate guard check "$cmd" </dev/tty 2>/dev/tty; then
140
+ unset __TOLLGATE_GUARD_RUNNING
141
+ zle .accept-line
142
+ else
143
+ unset __TOLLGATE_GUARD_RUNNING
144
+ # Clear the buffer and show message
145
+ BUFFER=""
146
+ zle redisplay
147
+ echo "\\nCommand cancelled by Tollgate Guard" >/dev/tty
148
+ fi
149
+ }
150
+
151
+ # Override accept-line widget
152
+ # The dot prefix (.accept-line) calls the built-in version
153
+ zle -N accept-line __tollgate_guard_accept_line
154
+
155
+ __TOLLGATE_GUARD_INSTALLED=1
156
+
157
+ # Helper functions
158
+ tollgate-guard-disable() {
159
+ export TOLLGATE_GUARD_DISABLED=1
160
+ echo "Tollgate Guard disabled for this session"
161
+ }
162
+
163
+ tollgate-guard-enable() {
164
+ unset TOLLGATE_GUARD_DISABLED
165
+ echo "Tollgate Guard enabled"
166
+ }
167
+
168
+ tollgate-guard-status() {
169
+ if [[ -n "$TOLLGATE_GUARD_DISABLED" ]]; then
170
+ echo "Tollgate Guard: DISABLED"
171
+ else
172
+ echo "Tollgate Guard: ENABLED"
173
+ fi
174
+ tollgate guard sessions 2>/dev/null || true
175
+ }
176
+ `;
177
+ /**
178
+ * Fish hook script using key binding.
179
+ *
180
+ * Fish doesn't support true preexec that can cancel commands,
181
+ * so we bind Enter to a custom function.
182
+ */
183
+ export const FISH_HOOK = `# Tollgate Guard - Fish Hook
184
+ # Usage: tollgate guard hook fish | source
185
+ # Or add to ~/.config/fish/config.fish: tollgate guard hook fish | source
186
+
187
+ # Skip if already installed
188
+ set -q __TOLLGATE_GUARD_INSTALLED; and exit 0
189
+
190
+ function __tollgate_guard_check
191
+ # Skip if disabled
192
+ set -q TOLLGATE_GUARD_DISABLED; and return 0
193
+
194
+ # Skip empty command
195
+ set -l cmd (commandline -b)
196
+ test -z "$cmd"; and return 0
197
+
198
+ # Skip if already running
199
+ set -q __TOLLGATE_GUARD_RUNNING; and return 0
200
+
201
+ # Fast path for safe commands
202
+ set -l first_word (string split ' ' -- $cmd)[1]
203
+ switch $first_word
204
+ case ls cd pwd echo cat less more head tail grep find which type man help history alias
205
+ return 0
206
+ end
207
+
208
+ # Fast path for git read-only
209
+ switch $cmd
210
+ case "git status*" "git diff*" "git log*" "git branch*" "git show*"
211
+ return 0
212
+ end
213
+
214
+ set -g __TOLLGATE_GUARD_RUNNING 1
215
+
216
+ # Call tollgate guard check
217
+ if tollgate guard check "$cmd" </dev/tty 2>/dev/tty
218
+ set -e __TOLLGATE_GUARD_RUNNING
219
+ return 0
220
+ else
221
+ set -e __TOLLGATE_GUARD_RUNNING
222
+ commandline ""
223
+ echo "Command cancelled by Tollgate Guard"
224
+ return 1
225
+ end
226
+ end
227
+
228
+ function __tollgate_guard_execute
229
+ if __tollgate_guard_check
230
+ commandline -f execute
231
+ end
232
+ end
233
+
234
+ # Bind Enter key to our function
235
+ bind \\r __tollgate_guard_execute
236
+ bind \\n __tollgate_guard_execute
237
+
238
+ set -g __TOLLGATE_GUARD_INSTALLED 1
239
+
240
+ # Helper functions
241
+ function tollgate-guard-disable
242
+ set -gx TOLLGATE_GUARD_DISABLED 1
243
+ echo "Tollgate Guard disabled for this session"
244
+ end
245
+
246
+ function tollgate-guard-enable
247
+ set -e TOLLGATE_GUARD_DISABLED
248
+ echo "Tollgate Guard enabled"
249
+ end
250
+
251
+ function tollgate-guard-status
252
+ if set -q TOLLGATE_GUARD_DISABLED
253
+ echo "Tollgate Guard: DISABLED"
254
+ else
255
+ echo "Tollgate Guard: ENABLED"
256
+ end
257
+ tollgate guard sessions 2>/dev/null; or true
258
+ end
259
+ `;
260
+ /**
261
+ * Get the appropriate hook script for a shell.
262
+ *
263
+ * @param shell - Shell type (bash, zsh, fish)
264
+ * @returns Hook script content
265
+ */
266
+ export function getHookScript(shell) {
267
+ switch (shell.toLowerCase()) {
268
+ case 'bash':
269
+ return BASH_HOOK;
270
+ case 'zsh':
271
+ return ZSH_HOOK;
272
+ case 'fish':
273
+ return FISH_HOOK;
274
+ default:
275
+ throw new Error(`Unsupported shell: ${shell}. Supported shells: bash, zsh, fish`);
276
+ }
277
+ }
278
+ /**
279
+ * Detect the current shell from environment.
280
+ */
281
+ export function detectShell() {
282
+ const shell = process.env.SHELL ?? '';
283
+ if (shell.includes('zsh')) {
284
+ return 'zsh';
285
+ }
286
+ if (shell.includes('fish')) {
287
+ return 'fish';
288
+ }
289
+ if (shell.includes('bash')) {
290
+ return 'bash';
291
+ }
292
+ // Default to bash
293
+ return 'bash';
294
+ }
295
+ /**
296
+ * Get the shell configuration file path.
297
+ */
298
+ export function getShellConfigPath(shell) {
299
+ const home = process.env.HOME ?? '~';
300
+ switch (shell.toLowerCase()) {
301
+ case 'bash':
302
+ return `${home}/.bashrc`;
303
+ case 'zsh':
304
+ return `${home}/.zshrc`;
305
+ case 'fish':
306
+ return `${home}/.config/fish/config.fish`;
307
+ default:
308
+ return `${home}/.bashrc`;
309
+ }
310
+ }
311
+ /**
312
+ * Generate the line to add to shell config.
313
+ */
314
+ export function getConfigLine(shell) {
315
+ switch (shell.toLowerCase()) {
316
+ case 'bash':
317
+ case 'zsh':
318
+ return 'eval "$(tollgate guard hook ' + shell + ')"';
319
+ case 'fish':
320
+ return 'tollgate guard hook fish | source';
321
+ default:
322
+ return 'eval "$(tollgate guard hook bash)"';
323
+ }
324
+ }
325
+ //# sourceMappingURL=index.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/guard/hooks/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6ExB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4EvB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4ExB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,QAAQ,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5B,KAAK,MAAM;YACT,OAAO,SAAS,CAAC;QACnB,KAAK,KAAK;YACR,OAAO,QAAQ,CAAC;QAClB,KAAK,MAAM;YACT,OAAO,SAAS,CAAC;QACnB;YACE,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,qCAAqC,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;IAEtC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kBAAkB;IAClB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC;IAErC,QAAQ,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5B,KAAK,MAAM;YACT,OAAO,GAAG,IAAI,UAAU,CAAC;QAC3B,KAAK,KAAK;YACR,OAAO,GAAG,IAAI,SAAS,CAAC;QAC1B,KAAK,MAAM;YACT,OAAO,GAAG,IAAI,2BAA2B,CAAC;QAC5C;YACE,OAAO,GAAG,IAAI,UAAU,CAAC;IAC7B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,QAAQ,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC;QACZ,KAAK,KAAK;YACR,OAAO,8BAA8B,GAAG,KAAK,GAAG,IAAI,CAAC;QACvD,KAAK,MAAM;YACT,OAAO,mCAAmC,CAAC;QAC7C;YACE,OAAO,oCAAoC,CAAC;IAChD,CAAC;AACH,CAAC"}
@@ -0,0 +1,29 @@
1
+ /**
2
+ * Tollgate Guard - AI Shell Guardian
3
+ *
4
+ * Intercepts and validates shell commands before execution,
5
+ * protecting developers from dangerous AI-suggested commands.
6
+ *
7
+ * @packageDocumentation
8
+ */
9
+ export type { GuardConfig, GuardContext, GuardResult, GuardEngineOptions, GuardRule, DenyPattern, GuardAction, RiskActionMapping, GuardSessionConfig, GuardFastPathConfig, GuardAuditConfig, GuardUIConfig, GuardAuditRecord, } from './types.js';
10
+ export { DEFAULT_GUARD_CONFIG, DEFAULT_RISK_ACTIONS, DEFAULT_SESSION_CONFIG, DEFAULT_FAST_PATH_CONFIG, DEFAULT_AUDIT_CONFIG, DEFAULT_UI_CONFIG, loadGuardConfig, validateGuardConfig, getConfigPaths, compileRules, compileDenylist, type CompiledRule, type CompiledDenyPattern, } from './config.js';
11
+ export { GuardEngine, createGuardEngine } from './engine.js';
12
+ export { EnhancedGuardEngine, createEnhancedGuardEngine, type EnhancedGuardEngineOptions, type EnhancedGuardResult, } from './enhanced-engine.js';
13
+ export { ContextProvider, createContextProvider, calculateRiskModifier, } from './context/index.js';
14
+ export type { EnhancedGuardContext, ProjectContext, ProjectType, GitContext, DirectoryContext, EnvironmentContext, } from './context/types.js';
15
+ export { detectProject, isRegenerablePath } from './context/project.js';
16
+ export { getGitContext, canRecoverFromGit, wouldAffectUncommittedWork } from './context/git.js';
17
+ export { scoreSensitivity, getSensitivePathsAffected } from './context/directory.js';
18
+ export { detectEnvironment, getEnvironmentRiskModifier } from './context/environment.js';
19
+ export { AlternativesFinder, createAlternativesFinder, findAlternatives, formatAlternatives, getSafestAlternative, } from './alternatives/index.js';
20
+ export type { SaferAlternative, AlternativeResult, AlternativeMapping, } from './alternatives/types.js';
21
+ export { PreviewGenerator, createPreviewGenerator, generatePreview, formatPreview, isDangerousPreview, getPreviewSummary, parseCommand, analyzeEffects, calculateImpact, } from './preview/index.js';
22
+ export type { CommandPreview, PreviewOptions, ParsedCommand, CommandEffect, ImpactAssessment, } from './preview/types.js';
23
+ export { ReversibilityAnalyzer, createReversibilityAnalyzer, assessReversibility, formatReversibility, requiresReversibilityWarning, getReversibilityIcon, getReversibilityColor, } from './reversibility/index.js';
24
+ export type { ReversibilityLevel, ReversibilityFactor, ReversibilityAssessment, } from './reversibility/index.js';
25
+ export { LearningEngine, createLearningEngine, createLearningEngineWithPath, JsonLearningStorage, formatLearningStats, hasEnoughDataForSuggestions, extractPattern, groupByPattern, buildLearnedPatterns, analyzeAndSuggest, formatSuggestions, exportSuggestionsAsYaml, suggestionToRule, DEFAULT_LEARNING_CONFIG, } from './learning/index.js';
26
+ export type { ApprovalRecord, ApprovalContext, LearnedPattern, RuleSuggestion, LearningStorage, LearningStats, LearningConfig, } from './learning/types.js';
27
+ export { EnhancedTerminalApprovalHandler, createEnhancedApprovalHandler, } from './approval/enhanced-terminal.js';
28
+ export type { EnhancedApprovalRequest, EnhancedApprovalResponse, } from './approval/enhanced-terminal.js';
29
+ //# sourceMappingURL=index.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,YAAY,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,SAAS,EACT,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAG7D,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,GACzB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,oBAAoB,EACpB,cAAc,EACd,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAChG,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAGzF,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,cAAc,EACd,cAAc,EACd,aAAa,EACb,aAAa,EACb,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,mBAAmB,EACnB,mBAAmB,EACnB,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,4BAA4B,EAC5B,mBAAmB,EACnB,mBAAmB,EACnB,2BAA2B,EAC3B,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,cAAc,GACf,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC"}
@@ -0,0 +1,31 @@
1
+ /**
2
+ * Tollgate Guard - AI Shell Guardian
3
+ *
4
+ * Intercepts and validates shell commands before execution,
5
+ * protecting developers from dangerous AI-suggested commands.
6
+ *
7
+ * @packageDocumentation
8
+ */
9
+ // Configuration
10
+ export { DEFAULT_GUARD_CONFIG, DEFAULT_RISK_ACTIONS, DEFAULT_SESSION_CONFIG, DEFAULT_FAST_PATH_CONFIG, DEFAULT_AUDIT_CONFIG, DEFAULT_UI_CONFIG, loadGuardConfig, validateGuardConfig, getConfigPaths, compileRules, compileDenylist, } from './config.js';
11
+ // Base Engine
12
+ export { GuardEngine, createGuardEngine } from './engine.js';
13
+ // Enhanced Engine
14
+ export { EnhancedGuardEngine, createEnhancedGuardEngine, } from './enhanced-engine.js';
15
+ // Context System
16
+ export { ContextProvider, createContextProvider, calculateRiskModifier, } from './context/index.js';
17
+ export { detectProject, isRegenerablePath } from './context/project.js';
18
+ export { getGitContext, canRecoverFromGit, wouldAffectUncommittedWork } from './context/git.js';
19
+ export { scoreSensitivity, getSensitivePathsAffected } from './context/directory.js';
20
+ export { detectEnvironment, getEnvironmentRiskModifier } from './context/environment.js';
21
+ // Alternatives Engine
22
+ export { AlternativesFinder, createAlternativesFinder, findAlternatives, formatAlternatives, getSafestAlternative, } from './alternatives/index.js';
23
+ // Preview System
24
+ export { PreviewGenerator, createPreviewGenerator, generatePreview, formatPreview, isDangerousPreview, getPreviewSummary, parseCommand, analyzeEffects, calculateImpact, } from './preview/index.js';
25
+ // Reversibility Analyzer
26
+ export { ReversibilityAnalyzer, createReversibilityAnalyzer, assessReversibility, formatReversibility, requiresReversibilityWarning, getReversibilityIcon, getReversibilityColor, } from './reversibility/index.js';
27
+ // Learning System
28
+ export { LearningEngine, createLearningEngine, createLearningEngineWithPath, JsonLearningStorage, formatLearningStats, hasEnoughDataForSuggestions, extractPattern, groupByPattern, buildLearnedPatterns, analyzeAndSuggest, formatSuggestions, exportSuggestionsAsYaml, suggestionToRule, DEFAULT_LEARNING_CONFIG, } from './learning/index.js';
29
+ // Enhanced Approval UI
30
+ export { EnhancedTerminalApprovalHandler, createEnhancedApprovalHandler, } from './approval/enhanced-terminal.js';
31
+ //# sourceMappingURL=index.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAmBH,gBAAgB;AAChB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,eAAe,GAGhB,MAAM,aAAa,CAAC;AAErB,cAAc;AACd,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAE7D,kBAAkB;AAClB,OAAO,EACL,mBAAmB,EACnB,yBAAyB,GAG1B,MAAM,sBAAsB,CAAC;AAE9B,iBAAiB;AACjB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAS5B,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAChG,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAEzF,sBAAsB;AACtB,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AAOjC,iBAAiB;AACjB,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAS5B,yBAAyB;AACzB,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,mBAAmB,EACnB,mBAAmB,EACnB,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAOlC,kBAAkB;AAClB,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,4BAA4B,EAC5B,mBAAmB,EACnB,mBAAmB,EACnB,2BAA2B,EAC3B,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAW7B,uBAAuB;AACvB,OAAO,EACL,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,iCAAiC,CAAC"}
@@ -0,0 +1,136 @@
1
+ /**
2
+ * Pattern Learning System for Shell Guardian
3
+ *
4
+ * Records approval decisions and learns patterns to suggest
5
+ * policy improvements over time.
6
+ */
7
+ import type { ApprovalRecord, LearnedPattern, RuleSuggestion, LearningStorage, LearningStats, LearningConfig, GetRecordsOptions } from './types.js';
8
+ import type { GuardConfig } from '../types.js';
9
+ import type { EnhancedGuardContext } from '../context/types.js';
10
+ import type { RiskLevel } from '../../analyzers/types.js';
11
+ export type { ApprovalRecord, ApprovalContext, LearnedPattern, RuleSuggestion, LearningStorage, LearningStats, LearningConfig, } from './types.js';
12
+ export { DEFAULT_LEARNING_CONFIG } from './types.js';
13
+ export { extractPattern, groupByPattern, buildLearnedPatterns, patternSimilarity, findSimilarPatterns, } from './pattern-extractor.js';
14
+ export { analyzeAndSuggest, formatSuggestions, exportSuggestionsAsYaml, suggestionToRule, findRefinementOpportunities, } from './rule-suggester.js';
15
+ /**
16
+ * JSON file-based learning storage.
17
+ */
18
+ export declare class JsonLearningStorage implements LearningStorage {
19
+ private readonly path;
20
+ private data;
21
+ constructor(path?: string);
22
+ /**
23
+ * Load data from file.
24
+ */
25
+ private load;
26
+ /**
27
+ * Save data to file.
28
+ */
29
+ private save;
30
+ saveRecord(record: ApprovalRecord): Promise<void>;
31
+ getRecords(options?: GetRecordsOptions): Promise<ApprovalRecord[]>;
32
+ getRecordsByPattern(pattern: string): Promise<ApprovalRecord[]>;
33
+ saveSuggestion(suggestion: RuleSuggestion): Promise<void>;
34
+ getSuggestions(): Promise<RuleSuggestion[]>;
35
+ updateSuggestion(id: string, update: Partial<RuleSuggestion>): Promise<void>;
36
+ clear(): Promise<void>;
37
+ getStats(): Promise<LearningStats>;
38
+ }
39
+ /**
40
+ * Learning Engine for Shell Guardian.
41
+ *
42
+ * Manages recording of approval decisions and generation
43
+ * of rule suggestions based on learned patterns.
44
+ */
45
+ export declare class LearningEngine {
46
+ private readonly storage;
47
+ private readonly config;
48
+ private recordStartTime?;
49
+ constructor(storage?: LearningStorage, config?: Partial<LearningConfig>);
50
+ /**
51
+ * Start timing a decision.
52
+ * Call this when showing the approval prompt.
53
+ */
54
+ startDecisionTimer(): void;
55
+ /**
56
+ * Record an approval decision.
57
+ *
58
+ * @param command - The command that was evaluated
59
+ * @param decision - The user's decision
60
+ * @param context - Enhanced guard context
61
+ * @param options - Additional options
62
+ */
63
+ record(command: string, decision: 'approved' | 'denied' | 'timeout', context: EnhancedGuardContext, options: {
64
+ riskLevel: RiskLevel;
65
+ chosenAlternative?: string;
66
+ sessionGrant?: {
67
+ scope: string;
68
+ duration: string;
69
+ };
70
+ }): Promise<void>;
71
+ /**
72
+ * Get all approval records.
73
+ */
74
+ getRecords(options?: GetRecordsOptions): Promise<ApprovalRecord[]>;
75
+ /**
76
+ * Get learned patterns from history.
77
+ */
78
+ getLearnedPatterns(): Promise<LearnedPattern[]>;
79
+ /**
80
+ * Generate rule suggestions based on learned patterns.
81
+ */
82
+ generateSuggestions(existingConfig?: GuardConfig): Promise<RuleSuggestion[]>;
83
+ /**
84
+ * Get existing suggestions.
85
+ */
86
+ getSuggestions(): Promise<RuleSuggestion[]>;
87
+ /**
88
+ * Accept a suggestion.
89
+ */
90
+ acceptSuggestion(id: string): Promise<void>;
91
+ /**
92
+ * Dismiss a suggestion.
93
+ */
94
+ dismissSuggestion(id: string): Promise<void>;
95
+ /**
96
+ * Get learning statistics.
97
+ */
98
+ getStats(): Promise<LearningStats>;
99
+ /**
100
+ * Clear all learning data.
101
+ */
102
+ clear(): Promise<void>;
103
+ /**
104
+ * Export suggestions as YAML for config.
105
+ */
106
+ exportSuggestionsYaml(): Promise<string>;
107
+ /**
108
+ * Format suggestions for display.
109
+ */
110
+ formatSuggestions(): Promise<string>;
111
+ /**
112
+ * Get refinement opportunities.
113
+ */
114
+ getRefinementOpportunities(): Promise<Array<{
115
+ pattern: string;
116
+ reason: string;
117
+ suggestion: string;
118
+ }>>;
119
+ }
120
+ /**
121
+ * Create a learning engine with default storage.
122
+ */
123
+ export declare function createLearningEngine(config?: Partial<LearningConfig>): LearningEngine;
124
+ /**
125
+ * Create a learning engine with custom storage path.
126
+ */
127
+ export declare function createLearningEngineWithPath(storagePath: string, config?: Partial<LearningConfig>): LearningEngine;
128
+ /**
129
+ * Format learning stats for display.
130
+ */
131
+ export declare function formatLearningStats(stats: LearningStats): string;
132
+ /**
133
+ * Quick check if there's enough data for suggestions.
134
+ */
135
+ export declare function hasEnoughDataForSuggestions(engine: LearningEngine, minRecords?: number): Promise<boolean>;
136
+ //# sourceMappingURL=index.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/guard/learning/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,cAAc,EACd,iBAAiB,EAClB,MAAM,YAAY,CAAC;AASpB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG1D,YAAY,EACV,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAGrD,OAAO,EACL,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAO7B;;GAEG;AACH,qBAAa,mBAAoB,YAAW,eAAe;IACzD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,IAAI,CAAe;gBAEf,IAAI,GAAE,MAA6B;IAK/C;;OAEG;IACH,OAAO,CAAC,IAAI;IAiBZ;;OAEG;IACH,OAAO,CAAC,IAAI;IAQN,UAAU,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAKjD,UAAU,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAwBlE,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAI/D,cAAc,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IASzD,cAAc,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAI3C,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ5E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAStB,QAAQ,IAAI,OAAO,CAAC,aAAa,CAAC;CA4BzC;AAWD;;;;;GAKG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkB;IAC1C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,eAAe,CAAC,CAAS;gBAG/B,OAAO,CAAC,EAAE,eAAe,EACzB,MAAM,GAAE,OAAO,CAAC,cAAc,CAAM;IAMtC;;;OAGG;IACH,kBAAkB,IAAI,IAAI;IAM1B;;;;;;;OAOG;IACG,MAAM,CACV,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,UAAU,GAAG,QAAQ,GAAG,SAAS,EAC3C,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE;QACP,SAAS,EAAE,SAAS,CAAC;QACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,YAAY,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;KACpD,GACA,OAAO,CAAC,IAAI,CAAC;IA6BhB;;OAEG;IACG,UAAU,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAIxE;;OAEG;IACG,kBAAkB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAMrD;;OAEG;IACG,mBAAmB,CAAC,cAAc,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAYlF;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAIjD;;OAEG;IACG,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD;;OAEG;IACG,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlD;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,aAAa,CAAC;IAIxC;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B;;OAEG;IACG,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC;IAM9C;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;IAM1C;;OAEG;IACG,0BAA0B,IAAI,OAAO,CAAC,KAAK,CAAC;QAChD,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;CAIJ;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAC/B,cAAc,CAEhB;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAC/B,cAAc,CAGhB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAyBhE;AAED;;GAEG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,cAAc,EACtB,UAAU,SAAK,GACd,OAAO,CAAC,OAAO,CAAC,CAGlB"}